ÐÇ¿ÕÈë¿Ú

Pain Management Coding Alert

Reader Question:

Yes, Even Small Practices Need a Complete Security Risk Analysis

Question: As a very small healthcare provider, do we really need to conduct an in-depth risk analysis? 

Maryland Subscriber 

Answer: The idea that a security risk analysis is optional for small providers is a myth, according to the HHS Office of the National Coordinator for Health Information Technology (ONC). All providers who qualify as covered entities (CEs) under HIPAA must perform a risk analysis. And you must conduct one if you want to receive EHR incentive payments. 

You can perform the risk analysis yourself using self-help tools; you don’t necessarily need to outsource the task, ONC says. “However, doing a thorough and professional risk analysis that will stand up to a compliance review will require expert knowledge that could be obtained through services of an experienced outside professional.” 

Remember: You don’t need to use any specific method, ONC notes. “A risk analysis can be performed in countless ways.” To get started, try using the Security Risk Assessment Tool at .

Other Articles in this issue of

Pain Management Coding Alert

View All